Platform Capabilities.
Capabilities
Nine capabilities. One compliance control plane. The architecture holds one model of the world, and every capability is a lens or controller over it: what you have, what you do, what is happening, what you are proving. Every framework is a projection of one defended implementation.
Capabilities
One model. Nine lenses.
Each capability answers one question, and explicit composition edges bind them: discovery populates the estate, change events re-evaluate posture, scan results become trends. Garrison is what you have. Vanguard is what you do. Sentinel is what's happening. Rampart is what you're proving. Alliance is who you trust. Armory is what's available. Outpost is what you scan before it connects. Artificer is the guide through all of it. Citadel is where all of it converges.
9 items
Aggregated command dashboard: a continuous posture base layer, an assessment overlay, and cards prioritized by role, never hard-filtered. Posture, alerts, inventory, and scan status converge here. WHERE IT ALL CONVERGES.
The observation limb: discovery, evidence collection, scheduled scanning, drift and alerting through a universal connector interface. Four collection profile classes; self-healing collection. What's HAPPENING.
The connected estate with full temporal history: what exists now, what existed at time T, hardware and software inventory for CM-8. Compliance history outlives the entity it describes. What you HAVE.
DevSecOps workbench: scan results, pipeline status, CI/CD integration. A signed FIPS scanner fleet spans code, dependencies, secrets, IaC, containers, SBOM, DAST, and STIG and CIS Benchmark checks. What you DO.
A first-class domain for scan targets not yet connected to a system: saved targets, trend history, and a graduation pipeline into the Garrison estate and Sentinel monitoring.
Hardened Terraform modules and signed, provenance-verified genome packages: skills, policy packs, remediation actors. Every deployment is a behavior change, governed as one. What's AVAILABLE.
Live-authorization compliance workspace: per-control posture computed from evidence-satisfaction state, cross-framework mapping, POA&Ms, and documents regenerated from living data. Assessments are projections of continuous state. What you're PROVING.
Cross-org trust as proof-exchange, not document-exchange: verifiable attestation sharing across the supply chain. Assessors participate as scoped, time-boxed actors with as-of evidence lenses. Who you TRUST.
Context-aware assistant: page and scope aware, streaming, persistent across the platform. Behind it, a RAG pipeline, a unified query planner, and convergence plans. The guide through complexity.